User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
References
| Link | Resource |
|---|---|
| https://www.fortra.com/security/advisories/product-security/fi-2026-005 | Vendor Advisory |
Configurations
History
23 Apr 2026, 13:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fortra
Fortra goanywhere Managed File Transfer |
|
| CPE | cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:* | |
| References | () https://www.fortra.com/security/advisories/product-security/fi-2026-005 - Vendor Advisory |
21 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 15:16
Updated : 2026-04-23 13:45
NVD link : CVE-2026-1089
Mitre link : CVE-2026-1089
CVE.ORG link : CVE-2026-1089
JSON object : View
Products Affected
fortra
- goanywhere_managed_file_transfer
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')